Docs / Building infrastructure
Plans and approvals
What the approval card shows and what approving binds you to.
A plan is the output of terraform plan for a change, run against your account. The approval card is built from that output, not from the assistant’s description of it.
The approval card
| Part | What it shows |
|---|---|
| Counts | How many resources are added, changed, replaced and destroyed. |
| Groups | Every changed resource under what it is for: network, access, compute, data, names and certificates, and anything else. |
| Destruction | A plan that destroys or replaces existing infrastructure says so first. |
| Policy | Each finding, worst first. A blocking finding removes the Approve button. |
| Output | The full plan run output, one click away. |
Approving
Approving applies the exact plan file that was produced. The approval is bound to that plan’s digest, and the file is checked again before Terraform reads it, so what is built is what you read. An approval expires after a few minutes; Reject still works after that.
Plans SysJ refuses to apply
- A plan with a blocking policy finding.
- A plan that would stop managing infrastructure that still exists without destroying it, which usually means it ran against the wrong place or something was deleted by hand. SysJ names those resources.
Who can approve
| Action | Permission |
|---|---|
| Ask for a plan | plan.create |
| Read a plan | plan.read |
| Approve, so the cluster is built or changed | cluster.manage |
| Approve a plan that destroys or replaces anything | cluster.manage and plan.approve_destructive |